{"id":"CVE-2026-120471","kind":"vulnerability","aliases":["CVE-2026-120471"],"related":[],"title":"AcyMailing for Joomla: restricted site modules render to unauthenticated visitors","description":"Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated visitor can cause a site module to be rendered regardless of the Joomla access level that module is restricted to, which discloses content reserved for a higher view level. The WordPress plugin is not affected.","summary":"AcyMailing, a Joomla extension, can render a site module regardless of the access level that module is restricted to. An unauthenticated visitor can therefore see content meant only for higher access levels.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["acymailing","joomla","package","self-hosted"],"not_affected_if":["no-restricted-modules","not-joomla","wordpress-plugin"],"how_to_check":"- Check the installed AcyMailing version in the Joomla extensions manager; affected range is 1.0.0 through 11.1.1.\n- Look for Joomla site modules restricted to a non-public access level that are placed on pages visible to anonymous visitors.","fix":null,"status":"open","published_at":"2026-11-12T18:17:18+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","triaged_at":"2026-11-12T18:42:51+00:00","updated_at":"2026-11-12T18:42:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T18:42:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"AcyMailing for Joomla: restricted site modules render to unauthenticated visitors","impact":"low","summary":"AcyMailing, a Joomla extension, can render a site module regardless of the access level that module is restricted to. An unauthenticated visitor can therefore see content meant only for higher access levels.","audience":"businesses","category":"package","nicknames":[],"who_cares":["joomla","acymailing","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"anonymous visitors read content reserved for higher access levels","analyst_note":"Confirm the fixed version in the NVD entry or the vendor advisory; the sources here give no fixed version.","how_to_check":"- Check the installed AcyMailing version in the Joomla extensions manager; affected range is 1.0.0 through 11.1.1.\n- Look for Joomla site modules restricted to a non-public access level that are placed on pages visible to anonymous visitors.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["wordpress-plugin","not-joomla","no-restricted-modules"],"who_is_affected":"Sites running the AcyMailing Joomla extension between versions 1.0.0 and 11.1.1. The WordPress plugin is not affected. Sites that do not use AcyMailing or do not restrict modules by access level are unlikely to expose anything.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000727,"input_tokens":4585,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120471':13A,16A '-2026':12A,15A '1.0.0':67C '11.1.1':68C 'access':35B,53B,63C,84C 'acymail':1A,17B,23B,66C 'acymailing.com':57C 'affect':105C 'caus':73C 'content':48B,93C 'cve':11A,14A 'disclos':92C 'extens':26B,56C 'higher':52B,97C 'host':22B 'joomla':3A,18B,25B,55C,83C 'level':36B,54B,64C,85C,99C 'meant':49B 'modul':6A,31B,38B,59C,76C,87C 'outsid':61C 'packag':19B 'plugin':102C 'regardless':32B,80C 'render':7A,28B,60C,79C 'reserv':94C 'restrict':4A,40B,89C 'see':47B 'self':21B 'self-host':20B 'site':5A,30B,58C,75C 'therefor':46B 'unauthent':9A,43B,70C 'view':98C 'visitor':10A,44B,71C 'wordpress':101C","nicknames":[],"mitigations":[],"who_affected":"Sites running the AcyMailing Joomla extension between versions 1.0.0 and 11.1.1. The WordPress plugin is not affected. Sites that do not use AcyMailing or do not restrict modules by access level are unlikely to expose anything.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["acymailing","joomla","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-120471':13A,16A '-2026':12A,15A 'acymail':1A 'cve':11A,14A 'joomla':3A 'modul':6A 'render':7A 'restrict':4A 'site':5A 'unauthent':9A 'visitor':10A","search_b":"'access':35B,53B 'acymail':17B,23B 'content':48B 'extens':26B 'higher':52B 'host':22B 'joomla':18B,25B 'level':36B,54B 'meant':49B 'modul':31B,38B 'packag':19B 'regardless':32B 'render':28B 'restrict':40B 'see':47B 'self':21B 'self-host':20B 'site':30B 'therefor':46B 'unauthent':43B 'visitor':44B","search_c":"'1.0.0':67C '11.1.1':68C 'access':63C,84C 'acymail':66C 'acymailing.com':57C 'affect':105C 'caus':73C 'content':93C 'disclos':92C 'extens':56C 'higher':97C 'joomla':55C,83C 'level':64C,85C,99C 'modul':59C,76C,87C 'outsid':61C 'plugin':102C 'regardless':80C 'render':60C,79C 'reserv':94C 'restrict':89C 'site':58C,75C 'unauthent':70C 'view':98C 'visitor':71C 'wordpress':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120471","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120471","severity":null,"published_at":"2026-11-12T18:17:18+00:00","modified_at":"2026-11-12T18:17:18+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","fetched_at":"2026-11-12T18:40:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}